Domain 2.3 Given a scenario, troubleshoot common security issues.

Question 1

Syslog server

Answer 1

a centralized server that aggregates the log files from the devices on the network.

Question 2

where would you check for a revoked certificate

Answer 2

a CRL (Certificate Revokation List) which is updated only when you get to it or OCSP ( Online Certificate Status Protocol) which is realtime/immediate.

Question 3

test question “blah blah, you need to revoke a certificate, now blah blah.”

Answer 3

only available correct answer on the test is CRL (Certificate Revocation List).

Question 4

Data exfiltration

Answer 4

Data leaving this network

Question 5

Baseline Deviation

Answer 5

Any changes to the default baseline by anyone other than an administrator is a baseline deviation

Question 6

Baseline

Answer 6

build out one computer exactly how you want each future computer setup. Create an image and apply that image/baseline to other computers.

Question 7

What is a content filter mechanism that can reduce the possibility of malicious executable code being accepted as input?

A. Checking the length
B. Blocking hex characters
C. Escaping metacharacters
D. Filtering on known patterns of malicious content

Answer 7

C. Escaping metacharacters

Question 8

You are called to a investigate an incident on the network where a user has installed unauthorized software which resulting in a RAT being installed. Of the following which is true? (Select Two)

A. Nothing is wrong since a RAT is not a concern.
B. Unauthorized software installation would have been prevented with an application whitelist.
C. The user should have scanned the file prior to installing it.
D. Users privileges should be reviewed.

Answer 8

B. Unauthorized software installation would have been prevented with an application whitelist.

D. Users privileges should be reviewed.